$ cve CVE-2013-3661 JSON

CVE-2013-3661 EXPLOIT

4.9

MEDIUM · CVSS 2.0 · EPSS 3.9% (pctl 90)

Patch early

A public exploit exists.

Description

The EPATHOBJ::bFlatten function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows Server 2012, and Windows RT does not check whether linked-list traversal is continually accessing the same list member, which allows local users to cause a denial of service (infinite traversal) via vectors that trigger a crafted PATHRECORD chain.

Scoring

CVSS	4.9 (MEDIUM, v2.0)
Vector	AV:L/AC:L/Au:N/C:N/I:N/A:C
EPSS	3.85% — more likely to be exploited than 90% of all CVEs
Weakness	CWE-22
On CISA KEV	no
Public exploit	yes
Published	2013-05-24
Last modified	2026-06-16

Affected (8)

Vendor	Product
microsoft	windows 7
microsoft	windows 8
microsoft	windows rt
microsoft	windows server 2003
microsoft	windows server 2008
microsoft	windows server 2012
microsoft	windows vista
microsoft	windows xp

Public exploits

Source	Title	Date
exploit-db	Microsoft Windows - 'EPATHOBJ::pprFlattenRec' Local Privilege Escalation (Metasploit)	2013-07-02
exploit-db	Microsoft Windows NT/2000/2003/2008/XP/Vista/7/8 - 'EPATHOBJ' Local Ring	2013-06-03
exploit-db	Microsoft Windows - Win32k!EPATHOBJ::pprFlattenRec Uninitialized Next Pointer Testcase	2013-05-21

References

→ the Explorer · watch your stack · NVD